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Though more than 600 million people worldwide use the Internet, it takes only one virus writer 
make just about all of us miserable. Like a single stray neutron in a critical mass of plutonium, i 
virus can trigger a chain reaction that spews thousands ... 
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In this paper, we describe the development of a fielded application for detecting malicious execi 
in the wild. We gathered 1971 benign and 1651 malicious executables and encoded each as a tr 
example using n-grams of byte codes as features. ... 
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This paper concentrates on visualizing computer viruses without using virus specific signature 
information as a prior stage of the very important problem of detecting computer viruses. In thi 
paper, we address the fact that each viruses have its own ... 
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This paper presents DOME, a host-based technique for detecting several general classes of malii 
code in software executables. DOME uses static analysis to identify the locations (virtual addres: 
system calls within the software executables, ... 
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We describe the use of machine learning and data mining to detect and classify malicious execu 
as they appear in the wild. We gathered 1,971 benign and 1,651 malicious executables and eno 
each as a training example using n-grams of byte ... 
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Jones gives a great example of a homegrown virus protection system. 
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We present a tool for analysis and detection of malicious mobile code such as computer viruses 
internet worms based on the combined use of code simulation, static code analysis, and OS exe 
emulation. Unlike traditional anti-virus methods, the ... 
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Software researchers have already developed static code security checkers to parse through an( 
<u>source code</u> files, looking for security vulnerabilities [8, 9]. What about <u>executabh 
files? Can these files also ... 
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Malware — a generic term that encompasses viruses, trojans, spywares and other intrusive code 
widespread today. Malware analysis is a multi-step process providing insight into malware struc 
and functionality, facilitating the development of ... 
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The proliferation of malware has presented a serious threat to the security of computer systems 
Traditional signature-based anti-virus systems fail to detect polymorphic and new, previously ur 
malicious executables. In this paper, resting on the ... 
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Ubiquitous systems will integrate computers invisibly and unobtrusively in everyday objects. Da 
be catched from single or multi-sensor devices and will be used for context extraction. New loca 
based services will be adapted to user preferences. ... 
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Eudaemon is a technique that aims to blur the borders between protected and unprotected 
applications, and brings together honeypot technology and end-user intrusion detection and 
prevention. Eudaemon is able to attach to any running process, and redirect ... 
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With more computing platforms connected to the Internet each day, computer system security I 
become a critical issue. One of the major security problems is execution of malicious injected co 
this paper we propose new processor extensions that ... 
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The increasing monoculture in operating systems and key applications and the enormous expen 
N-version programming for custom applications mean that lack of diversity is a fundamental bar 
achieving survivability even for high value systems ... 
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Writes via unchecked pointer dereferences rank high among vulnerabilities most often exploited 
malicious code. The most common attacks use an unchecked string copy to cause a buffer overr 
thereby overwriting the return address in the function's ... 
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Applications in mobile multi-agent systems require a high degree of confidence that code that n 
inside the system will not be malicious and that any agents which are malicious can be identifiec 
contained. Since the inception of mobile agents, ... 
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One of the most common forms of security attacks involves exploiting a vulnerability to inject 
malicious code into an executing application and then cause the injected code to be executed. A 
theoretically strong approach to defending against any type ... 
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Use of stealth rootkit techniques to hide long-lived malicious processes is a current and alarmini 
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security issue. In this paper, we describe, implement, and evaluate a novel VMM-based hidden 
process detection and identification service called Lycosid ... 
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Software products are often built from commercial-off-the-shelf (COTS) components. When new 
releases of these components are made available for integration and testing, source code is usu 
not provided by the vendors. Various regression test selection ... 
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